Phylum
Phylum built a machine learning-based SaaS platform that detected malicious packages and vulnerabilities in open-source software registries, serving enterprise software development teams. It was acquired by Veracode in January 2025.
- Company typePrivate
- Founded2021
- HeadquartersEvergreen, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Phylum does
Phylum is a Colorado-based (Evergreen) software supply chain security company that built machine learning-driven tools to detect and block malicious code in open-source packages and to identify vulnerabilities across the software supply chain. The company's product is a SaaS platform that ingests telemetry from public package registries (npm, PyPI, RubyGems, and others) and applies analytics to flag malicious or risky packages before they enter enterprise development pipelines. Phylum served enterprise software development teams and security organizations concerned about open-source dependency risk, employing a horizontal segmentation approach targeting use cases around supply chain visibility and proactive package risk management.
The company monetized through a recurring SaaS subscription model and sold primarily into enterprise accounts via direct field sales. Phylum raised approximately $19.5 million across a $4.5 million seed round (June 2021, led by First In, with participation from CSOs at Coinbase and Robinhood) and a $15 million Series A (May 2022, led by ClearSky with Atlassian Ventures, SixThirty Ventures, First In, and TechOperators). The company was co-founded by Aaron Bray (CEO), Louis Lang (CTO), and Peter Morgan (President), and operated with 11-50 employees.
In January 2025, Phylum was acquired by Veracode, a Massachusetts-based application risk management company, to integrate its malicious package detection capabilities into Veracode's broader application security platform. The deal terms were not disclosed, and Phylum no longer operates as an independent company.
Phylum firmographics
Firmographics- Name
- Phylum
- Legal name
- Phylum, Inc.
- Website
- https://phylum.io
- Company type
- Private
- Founded year
- 2021
- Operating status
- Acquired
- Headcount range
- 11–50 employees
- Short description
- Phylum built a machine learning-based SaaS platform that detected malicious packages and vulnerabilities in open-source software registries, serving enterprise software development teams. It was acquired by Veracode in January 2025.
- Ownership category
- akta.pro rank
Phylum industry classification
Industry- Product category
- Software Supply Chain Security
- NAICS
- Software Publishers (5132)
- SIC
- Services-Prepackaged Software (7372)
- akta.pro primary industry
- Software Supply Chain & Dependency Security (SBOM, Signing) (HDADACAD)
- akta.pro secondary industries
- Application Security & DevSecOps Services (BPAKAHAJ), DevSecOps & Supply Chain Security (DevOps toolchain security) (BPAEAKAI)
Keywords
Where Phylum is headquartered
LocationHeadquarters
- HQ city
- Evergreen
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
Phylum business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Infrastructure
Revenue model
- Software Supply Chain Security Subscription: SaaS subscription-based model providing ongoing risk management and monitoring for open-source supply chain security
Go-to-market motion1 record
Phylum product offering
Product offeringCore offering
Phylum built a machine-learning-driven software supply chain security platform that identifies and blocks malicious packages and vulnerabilities in open-source registries. The platform provided enterprise development teams with automated risk analysis and monitoring of third-party open-source libraries before code entered their pipelines. Following its January 2025 acquisition by Veracode, the technology is being integrated into Veracode's broader application risk management offering.
Product overview
Phylum was a software supply chain security company offering risk management tools for open-source supply chains. The company specialized in using machine learning and analytics to identify malicious packages and vulnerabilities. Phylum operated as a standalone product until its acquisition by Veracode in January 2025, after which its technology was integrated into Veracode's application risk management platform to improve detection and blocking of malicious code in open-source libraries.
Differentiator
Problem solved
Functional benefit
Products and services
- Phylum Supply Chain Risk Management Platform Software-as-a-service platform that uses machine learning and analytics to detect malicious packages and vulnerabilities in open-source registries, providing enterprise software development teams with ongoing supply chain risk monitoring.
- Phylum Malicious Package Analysis Automated detection and analysis of malicious packages in open-source registries, designed to protect software supply chains from compromised dependencies. Following Veracode's January 2025 acquisition, the capability is integrated into Veracode's broader application risk management platform for enterprise customers.
Companies that use Phylum
Customer profileSegments1 record
Ideal customer profiles1 record
Phylum technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Feature2 records
Phylum partnerships and signals
Strategic signalPartnerships
One partnership is on record.
- VeracodeflagshipAcquired Phylum in January 2025 to bolster Veracode's software supply chain security capabilities. The acquisition aims to improve detection and blocking of malicious code in open-source libraries. Phylum's technology is being integrated into Veracode's application security platform.
Scale indicators3 records
Recent moves5 records
Expansion highlights4 records
Phylum competitors and assessment
Company assessmentDirect peers
- Snyk: Snyk is a direct competitor in open-source supply chain security, offering SCA, malicious package detection, and developer security tooling. It targets the same enterprise software teams and overlaps directly with Phylum's core capability.
- Sonatype: Sonatype is a direct competitor via its Nexus platform, focused on open-source component intelligence, malicious package detection, and software supply chain governance — closely aligned with Phylum's offering.
- Mend (formerly WhiteSource): Mend is a direct competitor in open-source security and license compliance, providing SCA tools that overlap with Phylum's supply chain risk identification capabilities.
Emerging players
- Socket: Socket is an emerging developer-focused supply chain security company specializing in detecting malicious and risky open-source packages — a more direct narrow competitor to Phylum's malicious package focus than the broad incumbents.
- Chainguard: Chainguard is an emerging player in software supply chain security focused on hardened, minimal container images and supply chain integrity — adjacent to Phylum's open-source risk management capability.
- Anchore: Anchore is an emerging player in software supply chain security focused on container and image compliance, SBOM, and vulnerability analysis — adjacent to Phylum's supply chain risk identification capability.
Broad incumbents
- Veracode: Veracode is the broad incumbent application security platform that acquired Phylum in January 2025. It offers SAST, DAST, and SCA — a bundled AppSec platform where Phylum's supply chain technology is now integrated.
- GitHub Advanced Security: GitHub Advanced Security is a broad incumbent bundling Dependabot, code scanning, and secret scanning within the GitHub developer platform — directly competing for the same developer-tooling budget as Phylum.
- JFrog Xray: JFrog Xray is a broad incumbent providing software composition analysis and supply chain security as part of the JFrog Artifactory platform — competing with Phylum on open-source vulnerability and risk identification.
- Checkmarx: Checkmarx is a broad incumbent in application security offering SAST, SCA, and supply chain security — competing for the same enterprise AppSec budget as Phylum's specialized offering.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat4 records
Key risks6 records
Key highlights6 records
Customer concentration
Phylum social profiles
Digital presencePhylum financial estimates
Financial estimateRevenue estimate
Valuation estimate
Phylum leadership team
Management profileNumber of profiles
Profiles4 records
Phylum funding detail
Funding detailFunding overview
Funding rounds2 records
Investors9 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Phylum M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Phylum
What does Phylum do?
Phylum built a machine-learning-driven software supply chain security platform that identifies and blocks malicious packages and vulnerabilities in open-source registries. The platform provided enterprise development teams with automated risk analysis and monitoring of third-party open-source libraries before code entered their pipelines. Following its January 2025 acquisition by Veracode, the technology is being integrated into Veracode's broader application risk management offering.
Is Phylum a public or private company?
Phylum is a private company. It is classified as corporate owned and is currently acquired.
When was Phylum founded?
Phylum was founded in 2021. It employs 11 to 50 people.
Where is Phylum based?
Phylum is headquartered in Evergreen, United States, in the North America region.
How does Phylum make money?
One revenue line is on record: software Supply Chain Security Subscription.
Who are Phylum's main competitors?
Direct peers on record are Snyk, Sonatype and Mend (formerly WhiteSource). Emerging players are Socket, Chainguard and Anchore. Broad incumbents are Veracode, GitHub Advanced Security, JFrog Xray and Checkmarx.
Does Phylum have an API?
No public API is recorded for Phylum.
What industry is Phylum in?
Phylum's product category is Software Supply Chain Security. Its primary akta.pro industry code is HDADACAD, Software Supply Chain & Dependency Security (SBOM, Signing), with a secondary code of BPAKAHAJ, Application Security & DevSecOps Services. Its NAICS code is 5132 and its SIC code is 7372.